⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1815

ppatomfwctrl: voltage-object VBIOS walk uses attacker-controlled structuresize/object_size -> OOB read + infinite-loop DoS

Summary

pp_atomfwctrl_lookup_voltage_type_v4 at 33-34 size=le16(structuresize) from VBIOS NO ref to actual BIOS alloc; 39 while(offset<size); 41 deref (unsigned long)table+offset no in-bounds check; 47 stride=le16(object_size) from VBIOS. object_size==0 -> offset+=0 -> infinite loop hard hang at attach. structuresize=0xFFFF actual alloc 64 bytes -> walk 9362 iters read up to ~64KB past BIOS kmalloc into adjacent slab. Same class as DF-1674 VBIOS PowerPlay parser family. Malicious PCIe GPU/reflashed VBIOS. Fix: clamp size to bios_size; require object_size>=sizeof(header); stop when offset+obj_size>size.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1815 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 866 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1815 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:33-47. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

AMD GPU powerplay (not in GENERIC, no AMD HW). Source: voltage_object_info_table walk uses attacker-controlled structuresize (le16 from VBIOS) as the upper bound at L39 with no in-bounds check against the actual allocation, and uses object_size (le16) as the stride at L47; object_size==0 causes infinite loop, large values OOB. Confirmed in source.

Declare obj_size, break the walk on zero stride (defends against infinite loop / OOB read past the VBIOS table).

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1815/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Declare obj_size; break the walk on zero stride. Full git-apply-able diff in findings/poc/DF-1815/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:33-47. AMD GPU powerplay VBIOS voltage_object_info_table walk uses attacker-controlled structuresize (le16) as upper bound at L39 with no in-bounds check; object_size (le16) at L47 used as stride with no zero check (infinite loop) or upper bound (OOB read past VBIOS table). HW-gated: not in GENERIC, no AMD GPU. Reproduction not possible on the audit guest. Fix compile-validated as part of combined 41-finding kernel build (rc=0, -Werror clean).